VulnHub

Threema, a secure messaging platform, experienced significant disruptions earlier this week due to multiple distributed denial-of-service (DDoS) attacks. These attacks overwhelmed Threema's servers, causing service outages and making it difficult for users to send messages. While the company worked to restore normal operations, the incident raised concerns about the security of communication platforms and the potential for similar attacks in the future. Such disruptions can affect users' ability to securely communicate, particularly in sensitive situations where privacy is paramount. This event serves as a reminder of the vulnerabilities that even well-regarded secure services can face from malicious actors.

A new botnet named Evooo1Bot has emerged, targeting internet-facing routers and other gateway devices. Based on the Mirai malware, this botnet converts these devices into SOCKS5 traffic relay nodes, allowing attackers to route internet traffic through them. This can enable various types of malicious activities, including distributed denial-of-service (DDoS) attacks. The attack affects any vulnerable Linux-based routers or similar devices that are exposed to the internet, making it crucial for users and network administrators to secure their devices against unauthorized access. As the botnet continues to spread, it poses a significant risk to network integrity and privacy.

DDoS attacks have surged in scale during the first half of 2026, according to Cloudflare's latest report. Attackers are employing multi-vector techniques, leading to massive traffic floods that can exceed 1 terabit per second. These hyper-volumetric campaigns are impacting various online services across multiple industries, causing disruptions that can cripple businesses and services. The report notes that these attacks are not only larger but also shorter in duration, suggesting a shift towards more automated and efficient methods of conducting these attacks. As organizations increasingly rely on online services, the growing frequency and intensity of DDoS attacks present a significant challenge to cybersecurity.

Researchers from Palo Alto Networks Unit 42 have identified a new version of the Kimwolf botnet, known as Kimwolf v7, which targets Android devices and Internet of Things (IoT) devices. This upgraded botnet enhances its ability to launch distributed denial-of-service (DDoS) attacks by disguising its HTTP/2 traffic to resemble legitimate web browsing. This makes it harder for security systems to detect and mitigate the attacks. The discovery of Kimwolf v7 raises concerns for users of vulnerable Android and IoT devices, as attackers can exploit these weaknesses to disrupt services and potentially gain unauthorized access to sensitive information. Companies and users need to be vigilant and ensure their devices are secured against such threats.

In the second quarter of this year, Cloudflare reported a significant increase in large-scale distributed denial-of-service (DDoS) attacks, mitigating over 800 incidents that exceeded 1 terabit per second (Tbps). This marks a fivefold surge compared to the previous quarter, indicating a growing trend in the severity of DDoS attacks. These attacks primarily target online services and can disrupt normal operations, affecting businesses and their customers. The rise in attack volume is concerning, as it suggests that attackers are increasingly capable of leveraging powerful botnets to overwhelm networks. Companies need to be vigilant and consider bolstering their defenses against such high-capacity attacks to maintain service availability.

Researchers from Cisco Talos have discovered that hackers are exploiting simple authorization claims to circumvent security measures in artificial intelligence systems. This vulnerability allows them to create tools for Distributed Denial of Service (DDoS) attacks, steal user credentials, and gain access to live camera feeds. The implications are significant, as it poses a risk to various platforms that utilize AI to manage security protocols. Companies that rely on AI for protection need to be vigilant and assess their defenses to prevent unauthorized access and potential data breaches. This incident serves as a reminder of the evolving tactics used by cybercriminals to exploit weaknesses in technology.

A new botnet called Tengu, derived from the well-known Mirai botnet, has been identified targeting compromised Linux devices. Researchers from Nozomi Networks Labs found that Tengu can utilize a device's hardware watchdog feature to reboot itself whenever defenders attempt to terminate its main process. This persistence method allows Tengu to re-establish its operation even after being interrupted. The botnet primarily gains access through brute-force attacks on Telnet credentials. Tengu is capable of launching distributed denial-of-service (DDoS) attacks, which can overwhelm targeted systems and disrupt online services. This incident raises concerns for organizations relying on Linux devices, as Tengu's ability to persist poses a significant challenge for cybersecurity defenses.

A new botnet named Dysphoria has taken control of approximately 200,000 devices globally. This botnet is primarily being used to conduct distributed denial of service (DDoS) attacks and to relay traffic, which can disrupt services and overwhelm targeted networks. The widespread nature of Dysphoria means that it could potentially affect various sectors, making it a significant concern for cybersecurity experts. Users with compromised devices may experience slower internet speeds or disruptions in service, while organizations could face costly downtime and reputational damage. The rapid spread of this botnet underscores the ongoing challenges in securing Internet of Things (IoT) devices and emphasizes the need for improved security practices among users and manufacturers alike.

A recent report from Lumen's Black Lotus Labs reveals that botnets, including IPIDEA, are continuing to grow despite multiple takedown efforts. Approximately 25% of the compromised IP addresses are located in the United States. Following disruptions aimed at these botnets, they have managed to quickly regain and even surpass their previous size. This resurgence poses ongoing risks, as botnets can facilitate various cybercrimes, including DDoS attacks and data theft. The persistence of these networks indicates that current strategies to combat them may not be sufficient, and cybersecurity efforts need to be reevaluated.

The latest Malware Newsletter from Security Affairs includes several notable malware threats. One of these is CrashStealer, a C++ infostealer for macOS that masquerades as a crash reporter, targeting users to extract sensitive information. Another threat, Lucide Proxy, is exploiting student web proxies to create DDoS bots, potentially impacting educational institutions. Additionally, the AsyncAPI npm organization has been compromised, affecting about 2 million weekly downloads, which raises concerns for developers relying on these packages. Lastly, OkoBot is a sophisticated malware framework specifically designed to target cryptocurrency users, highlighting the ongoing risks in the digital currency space. These developments illustrate the evolving tactics of cybercriminals and the need for users and organizations to stay vigilant.

A newly discovered vulnerability known as HollowByte poses a significant risk to OpenSSL servers by allowing unauthenticated attackers to create a denial-of-service (DoS) condition with a payload as small as 11 bytes. This flaw can lead to excessive memory consumption on affected servers, potentially causing them to crash or become unresponsive. The issue affects various OpenSSL implementations, which are widely used for secure communications on the internet. As the vulnerability is easy to exploit, it raises concerns for organizations relying on OpenSSL for their security infrastructure. Companies using OpenSSL should prioritize patching and implementing security measures to mitigate the risks associated with this vulnerability.

A recent study by JFrog revealed that 148 npm packages masqueraded as student proxy tools, turning users' browsers into a distributed denial-of-service (DDoS) botnet for about two weeks in May. These packages did not target developers but instead leveraged the npm registry to host a malicious proxy site, attracting students looking to bypass restrictions. Once installed, the packages allowed attackers to harness the computing power of visitors' browsers to launch DDoS attacks. This incident raises concerns about the security of open-source package repositories and highlights the potential risks for users who may unknowingly install compromised software. Developers and users alike need to be vigilant about the packages they choose to install to avoid becoming part of such attacks.

A new malware called RustDuck is actively hijacking various devices, including home routers, IP cameras, Android boxes, and poorly secured servers. The malware operates in two stages and connects these compromised devices into a botnet designed to launch Distributed Denial of Service (DDoS) attacks, effectively taking websites and online services offline. Researchers from QiAnXin's XLab have been monitoring RustDuck since February 2026 and note that its rapid evolution is particularly concerning. This highlights the vulnerability of consumer devices and poorly secured servers, which can be easily exploited by attackers. Users and organizations need to ensure their devices are secured to prevent becoming part of such a botnet.

A new type of malware called AryStinger is infecting legacy home routers, turning them into a distributed reconnaissance and proxy network. Researchers from QiAnXin's XLab have identified at least 4,300 infected routers, and that number is likely to grow. Unlike typical malware that creates a DDoS botnet, AryStinger is designed for the reconnaissance phase of an attack, gathering information before any actual intrusion occurs. This shift in tactics poses a significant risk as attackers can use these compromised devices to gather sensitive data about potential targets without raising alarms. Home users and organizations relying on older routers could find themselves vulnerable if these devices are compromised.